US10887344B2ActiveUtilityA1
Network endpoint spoofing detection and mitigation
Est. expirySep 22, 2037(~11.2 yrs left)· nominal 20-yr term from priority
H04L 69/22H04L 63/1483G06N 3/044G06F 18/22G06N 3/0499G06N 3/09H04L 43/026H04L 2463/141H04L 63/20H04L 63/1458H04L 63/1466H04L 43/16H04L 45/20G06N 20/00H04L 47/40H04L 45/74H04L 63/0227H04L 63/1416H04L 45/08G06N 3/084G06K 9/6215G06N 3/08
56
PatentIndex Score
0
Cited by
17
References
15
Claims
Abstract
Endpoint security systems and methods include a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by the target network endpoint system based on time-to-live (TTL) information from the received packet. A machine learning model is configured to estimate an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances. A spoof detection module is configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance. A security module is configured to perform a security action at the target network endpoint system responsive to the determination that the received packet has a spoofed source IP address.
Claims
exact text as granted — not AI-modifiedWhat is claimed is:
1. An endpoint security system implemented in a network endpoint system, comprising:
a distance estimation module configured to calculate a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by the target network endpoint system based on time-to-live (TTL) information from the received packet;
a machine learning model configured to estimate an expected travel distance between the source IP address and the target network endpoint system IP address based on a sparse set of known source/target distances, by determining a difference between the TTL information from the received packet and a default initial TTL value;
a spoof detection module comprising a processor configured to determine that the received packet has a spoofed source IP address based on a comparison between the calculated travel distance and the expected travel distance; and
a security module configured to perform a security action at the target network endpoint system responsive to the determination that the received packet has the spoofed source IP address.
2. The system of claim 1 , wherein the distance estimation module is further configured to determine structural correspondences between the source IP address and one or more known source IP addresses.
3. The system of claim 2 , wherein the distance estimation module is further configured to split the source IP address into at least a beginning portion and an end portion and padding the beginning portion and the end portion to form a normalized IP source address.
4. The system of claim 1 , wherein the distance estimation module is further configured to provide the source IP address and the target network endpoint system IP address to a neural network, where an activation function for neurons in the neural network is determined as:
f
i
=
{
i
=
1
softsign
(
w
d
×
256
i
=
0
×
B
256
×
1
i
=
0
+
b
d
×
1
i
=
0
)
i
∈
{
1
,
…
,
n
}
softsign
(
w
d
×
(
256
+
d
)
i
∈
{
1
,
…
,
n
}
×
concat
(
B
256
×
1
i
∈
{
1
,
…
,
n
}
,
f
d
×
1
i
-
1
)
+
b
d
×
1
i
∈
{
1
,
…
,
n
}
)
where i is a layer of the neural network, w d×256 i is a set of weights, d is a dimension of a final IP representation, B 256×1 i=0 is a byte value from a normalized IP address, b d×1 i is a set of biases, and n is a number of bytes in the normalized IP address.
5. The system of claim 1 , further comprising a training module configured to train a neural network to estimate distances between an input source IP address and an input destination IP address based on training data that comprises a sparse matrix of distances between known source IP addresses and destination IP addresses.
6. The system of claim 1 , wherein the spoof detection module is further configured to determine a difference between the calculated travel distance and the expected travel distance and comparing the determined difference to a threshold value.
7. The system of claim 1 , wherein the security module is further configured to perform at least one action selected from the group consisting of blocking traffic from the source IP address of the received packet, changing a system security policy, changing a packet filtering setting on an upstream device, discarding the received packet, and performing deep packet inspection.
8. The system of claim 1 , wherein the machine learning model is a neural network model.
9. A method for mitigating a spoofing-based attack at a network endpoint, comprising:
calculating a travel distance between a source Internet Protocol (IP) address and an IP address for a target network endpoint system from a received packet received by the target network endpoint system based on time-to-live (TTL) information from the received packet;
estimating an expected travel distance between the source IP address and the target network endpoint system IP address, based on a sparse set of known source/target distances, by determining a difference between the TTL information from the received packet and a default initial TTL value;
determining that the received packet has a spoofed source IP address using a processor based on a comparison between the calculated travel distance and the expected travel distance; and
performing a security action at the target network endpoint system, responsive to the determination that the received packet has the spoofed source IP address.
10. The method of claim 9 , wherein estimating the expected travel distance comprises determining structural correspondences between the source IP address and one or more known source IP addresses.
11. The method of claim 10 , wherein determining structural correspondences between the source IP address and one or more known IP source addresses comprises splitting the source IP address into at least a beginning portion and an end portion and padding the beginning portion and the end portion to form a normalized IP source address.
12. The method of claim 9 , wherein estimating the expected travel distance comprises providing the source IP address and the target network endpoint system IP address to a neural network, where an activation function for neurons in the neural network is determined as:
f
i
=
{
i
=
1
softsign
(
w
d
×
256
i
=
0
×
B
256
×
1
i
=
0
+
b
d
×
1
i
=
0
)
i
∈
{
1
,
…
,
n
}
softsign
(
w
d
×
(
256
+
d
)
i
∈
{
1
,
…
,
n
}
×
concat
(
B
256
×
1
i
∈
{
1
,
…
,
n
}
,
f
d
×
1
i
-
1
)
+
b
d
×
1
i
∈
{
1
,
…
,
n
}
)
where i is a layer of the neural network, w d×256 i is a set of weights, d is a dimension of a final IP representation, B 256×1 i=0 is a byte value from a normalized IP address, b d×1 i is a set of biases, and n is a number of bytes in the normalized IP address.
13. The method of claim 9 , further comprising training a neural network to estimate distances between an input source IP address and an input destination IP address based on training data that comprises a sparse matrix of distances between known source IP addresses and destination IP addresses.
14. The method of claim 9 , wherein determining that the received packet has the spoofed source IP address comprises determining a difference between the calculated travel distance and the expected travel distance and comparing the determined difference to a threshold value.
15. The method of claim 9 , wherein performing the security action comprises at least one action selected from the group consisting of blocking traffic from the source IP address of the received packet, changing a system security policy, changing a packet filtering setting on an upstream device, discarding the received packet, and performing deep packet inspection.Cited by (0)
No later patents cite this yet.
References (0)
No backward citations on record.